Multiple impostors, one host.

For every live lookalike we did a DoH A/AAAA lookup. Domains that resolve to the same IP are operationally linked: shared kit, shared operator, or shared cheap hosting. CDN anycast IPs (Cloudflare, Akamai, CloudFront, Fastly, Vercel) are hidden by default because thousands of unrelated tenants share each one. The interesting clusters are small, non-CDN, and span multiple brands - that's where one operator runs a portfolio.